Bitget Hack, Duelbits, ColdCard, Haruko, Liquid - Time to change?

[tperkara]

With billions already stolen from crypto, security can no longer be treated as an afterthought—one weak link can cost users everything.

[Darker45]

Which mindset in particular?

With the hacks mentioned, people might begin to get really confused. Some trusted custodians; their funds were stolen. Some didn't trust custodians and preferred to self-custody; their funds were stolen just the same. Some funds were kept online; they weren't sufficiently secured. Some funds were kept offline; they weren't sufficiently secured, either. 

So, which cliché to do away with? Internet must be freed from whom?

[TypoTonic]

Which mindset in particular?

With the hacks mentioned, people might begin to get really confused. Some trusted custodians; their funds were stolen. Some didn't trust custodians and preferred to self-custody; their funds were stolen just the same. Some funds were kept online; they weren't sufficiently secured. Some funds were kept offline; they weren't sufficiently secured, either.

So, which cliché to do away with? Internet must be freed from whom?

Perhaps it's the illusion of being in control. People tend to be complacent with their chosen methods, but the truth is that there's no perfect way to secure your coins. There will always be vulnerabilities and risks associated with any setup, and the human factor is always the weakest link.

[Taskford]

Which mindset in particular?

With the hacks mentioned, people might begin to get really confused. Some trusted custodians; their funds were stolen. Some didn't trust custodians and preferred to self-custody; their funds were stolen just the same. Some funds were kept online; they weren't sufficiently secured. Some funds were kept offline; they weren't sufficiently secured, either.

So, which cliché to do away with? Internet must be freed from whom?

Perhaps it's the illusion of being in control. People tend to be complacent with their chosen methods, but the truth is that there's no perfect way to secure your coins. There will always be vulnerabilities and risks associated with any setup, and the human factor is always the weakest link.

Real problem is they think that having a key is enough, but the problem is they are actually still exposed for exploits and other issues.

So even if there's no methods could guarantee them 100% protection, still they could do something like setting up multiple safeguard to lessen their chance to hit by an exploit.

Better aim doing things that can enhance their safety and don't join with wrong opinions, because that might give them a painful lesson which for sure they don't want to experience.

[Z-tight]

Some trusted custodians; their funds were stolen. Some didn't trust custodians and preferred to self-custody; their funds were stolen just the same.

That's the reason why i was so upset with the Coldcard hack, like it or not, it was a big blow to self-custody and those victims didn't deserve to lose their funds. Now people may be thinking, which hardware wallet manufacturer is next. I store my coins only in self-custodial wallets and that's all i recommend, but truth is, i don't usually have a good response when people ask me: 'what about the Coldcard incident'?

With billions already stolen from crypto, security can no longer be treated as an afterthought—one weak link can cost users everything.

Security of funds has always been something that should be taken seriously. Yeah, i understand that attacks have gottem more sophisticated, but it has always been a rule to protect your BTC from attackers and never expose your seed phrase.

[Darker45]

~snip~

Perhaps it's the illusion of being in control. People tend to be complacent with their chosen methods, but the truth is that there's no perfect way to secure your coins. There will always be vulnerabilities and risks associated with any setup, and the human factor is always the weakest link.

Which then brings us to a cycle. Because humans are said to be inherently weak, various services are offered, including banks and other custodians. But then banks and custodians themselves also failed in their responsibilities. Therefore, individuals must take back what they've entrusted to them. But because they're inherently weak, they also failed. So, yeah, there must be no perfect way.

Some trusted custodians; their funds were stolen. Some didn't trust custodians and preferred to self-custody; their funds were stolen just the same.

That's the reason why i was so upset with the Coldcard hack, like it or not, it was a big blow to self-custody and those victims didn't deserve to lose their funds. Now people may be thinking, which hardware wallet manufacturer is next. I store my coins only in self-custodial wallets and that's all i recommend, but truth is, i don't usually have a good response when people ask me: 'what about the Coldcard incident'?

And what about the Ledger Recover subscription? But you could go more technical, but the point remains.

[Z-tight]

And what about the Ledger Recover subscription? But you could go more technical, but the point remains.

I hate Ledger Recover and its implementation was were a lot of people drew the line with Ledger and their devices, and that's completely valid. In the future, it could lead to loss of funds, but right now it hasn't and that's why people don't really talk about it, but Coldcard that fucked their customers over. Yeah, it is a stupid idea to split a seed phrase into three fragments and send them over the internet, nobody should subscribe to that rubbish.

[tabas]

With billions already stolen from crypto, security can no longer be treated as an afterthought—one weak link can cost users everything.

And this is the responsibility of these platforms and so as we as individual users, we also need to be aware of our own security. While these platforms can be accountable if ever a small hole has been abused to them, they can potentially what is lost for their users. But we as individuals, if you are at fault there's no way that you'll get a potential refund or safu or however they call those funds recovery programs they have. We are our own security and we protect ourselves depending on the practice that we do.

[TypoTonic]

That's the reason why i was so upset with the Coldcard hack, like it or not, it was a big blow to self-custody and those victims didn't deserve to lose their funds. Now people may be thinking, which hardware wallet manufacturer is next.

That incident doesn't make every other hardware wallet unreliable. Coldcard got compromised due to their weak seed generation, but the risk could've been mitigated by using a strong passphrase.

I store my coins only in self-custodial wallets and that's all i recommend, but truth is, i don't usually have a good response when people ask me: 'what about the Coldcard incident'?

It serves as a reminder for users to generate their own seed phrase, and not to blindly trust any single device. Self-custody has risks, but it's our own responsibility to minimize them.

[Z-tight]

That incident doesn't make every other hardware wallet unreliable. Coldcard got compromised due to their weak seed generation, but the risk could've been mitigated by using a strong passphrase.

I know all this, i am talking about new users in the network and those whom i recommend self-custody over custodial storage to, they are not wrong to think in that way. As for a strong passphrase, it is a great extra layer of security, but you wouldn't always need it not to lose your funds, your seed phrase is enough, as long as you don't expose it. It would be unfair to turn to the Coldcard victims and ask them why they didn't extend their seed words with a passphrase.

It serves as a reminder for users to generate their own seed phrase, and not to blindly trust any single device.

It is not the most newbie-friendly thing to do, and rather than recommend this to newbies, it would be better for them to allow their wallet generate the seed phrase for them, so they don't screw themselves up.